Quantcast
Viewing latest article 1
Browse Latest Browse All 2

Answer by u1686_grawity for how to get print of ssh user logged in by password?

I want to know if it is possible to get the hash key fp from the ssh diaries for the ssh user login with a password, not a key. I see public key login keyprints recorded in the file, but no passwd logins fp

There's no "hash key fingerprint" because there is no key. That's literally what it means to use a password to authenticate instead of a key.

Common security advice is to simply disable password authentication and require all clients to use keys or similar methods.

Does it leave a unique footprint for each device? I tried verbose logging with the ssh demons but I don't see anything written to identify a user login with keyboard passwords besides ip address.

No, it doesn't. The IP address:port is all you have.

And the date/time, of course. If you see a login happened when you were asleep, then that's suspicious. But it doesn't say which device did it.

You could also look at the SSH client's version string (the one which says SSH-2.0-OpenSSH-etc in highly verbose levels) – of course, all Debian 10 clients look the same, all Arch clients look the same, but you can still distinguish an actual /usr/bin/ssh (OpenSSH) from various automated brute-forcing bots (which often use Java or Python SSH modules and this is reflected in the version string they send).


Viewing latest article 1
Browse Latest Browse All 2

Trending Articles